Legitimate interest (as mentioned in the GDPR) is your friend here. GDPR enforcement is not black and white and there is no specific rules or timeframes you’re

Legitimate interest (as mentioned in the GDPR) is your friend here. GDPR enforcement is not black and white and there is no specific rules or timeframes you’re allowed to keep data - instead, if there is a complaint, the regulator will work with you to understand your argument before any penalties are handed out, so you’ll be fine unless you’re obviously acting in bad faith. So deleting data from the primary data store while keeping backups for a reasonable amount of time (3 months?) is totally fine even though you are technically right in that the data hasn’t yet been fully deleted.